Risks in Information Systems Development Projects

Transcription

1 Ozren Đurković Lazar Raković Risks in Information Systems Development Projects Article Info:, Vol. 4 (2009), No. 1, pp Received 12 Jun 2008 Accepted 24 April 2009 UDC :005.8 Summary Risk is a part of all aspects of everyday life. Development of an informational system is a complex process, which makes it submissive to a great number of risks. Many projects do not achieve previously set goals, therefore risk management is not to be ignored in the development of informational systems. In this paper, the efficacy of IS development, as well as a number of risks influencing the project development, are considered. Also, attention is paid to the risk management methodology, simultaneously setting a framework for risk management in IS development. Key words Risk, Information systems development, projects. Introduction During the last years, the realization of business and other activities has been more and more burdened by complexity and uncertainty, resulting in an increasing risk and appearing in all the fields of human activities. There are many definitions of risk in professional literature which depends on specific fields and situations. The simplest definition of risk is that risk is a situation leading to negative consequences. In the definition of risk, the expressions of possible variants of actions (alternatives) and possible (insecure) realized ones point to uncertainty. Risk does not mean an approaching negative effect; it is a negatively assessed consequence where the realization is uncertain (Sedlak, 2002). As risk is increasingly present, the need to manage risk is also increasing. Risk management means the knowledge and science of identification, analyzing, as well as the answer to risk during the project life cycle in the best way to realize project goals (Bobera, 2007). As the work is based on risks appearing during information systems development, we shall deal, at the beginning, with reasons why it is necessary to manage risks in this field. The most important characteristics of IS developments, which also point to the seriousness of risk management, are (Ćirić, 2004): They are mostly complex projects with many mutually connected activities and participants, Risk immanency and uncertainty, They should be realized in the given time and within the framework of anticipated costs, They are determined by goals and tasks that should be attained, defined by the manager, i.e. the user. Necessity of competent experts, as well as sufficient material and financial resources, and so on. Thus, the projects of information systems development are very complex; therefore they are liable to the influence of many risks. Many researches in this field have been carried out on the subject of project successfulness in developing information systems. The Standish Group classifies the successfulness/performance in realizing information system development into three types. The first type represents successful projects, i.e. projects satisfying all requirements regarding to characteristics, functionalities, as well as the budget and time. The second type are the so- called challenged projects the projects which are finished and satisfy requirements regarding to characteristics and functionalities, but they are not finished in time and according to the budget frameworks. The third type is unsuccessful projects stopped during the developing period that is they have never been finished. In Figure 1 we can notice that most IS development projects can be classified into the second type, i.e. finished projects, but not in time and within financial frameworks that were set. Then, successful projects follow and after them unsuccessful projects. Taking into consideration an increasing competition in all the sectors, as well as the world economic crisis, it is very important to define factors and risks exerting influence on project unsuccessfulness, time limit excess and overinvestment.

2 Ozren Đurković, Lazar Raković Figure 2 illustrates successfulness in realizing IS development projects in the period from 1996 to Increased budget, time limit excess 53% Successful projects 29% Taking into consideration the illustrated results on successfulness in realizing IS development projects, it is necessary to define risks appearing in IS development. Then, it is necessary to select risk management methodology and define the way of risk management. Unsuccessful projects 18% Successful projects Unsuccessful projects Increased budget, time limit excess Figure 1 Sucessfulness in relizing IS development projects in 2004 (The Standish group report) 60% 50% 40% 30% 20% 10% 0% Successful projects 16% 27% 26% 28% 34% 29% Unsuccessful projects 31% 40% 28% 23% 15% 18% Increased budget, time limit excess 53% 33% 46% 49% 51% 53% Figure 2 Trend of successfulness in realizing IS development, (The Standish group report) We should not neglect the fact that project successfulnes depends to a great extent on the project value, number of the project team members, as well as the duration of time (Ćirić, 2004). Therefore, smaller projects with less team members and shorter periods needed to finish the project can represent prerequisites for a successful project end. Of course, it does not mean that a simple reduction of team members and project time can improve prerequisites for successfulness of big projects. Table 1 Project successfulness relating to the value, number of team members and project time (Ćirić, 2004) Project value less than $ from $ to $1.5 milion from $1.5 to $3 milion from $3 to 6 $milion from $ 6 do $10 milion over $ 10 milion Number of project team members Project time in months Successfulness rate % % % % more than more 250 than 24 8% more than more 500 than 36 0% 1. Risks in information systems development projects No matter it is a small or big software project, the software product is a very complex project. Unpredicted events, associated with project carrying out, can negatively affect the costs, term, quality and other aspects of information systems development. Risk is an event or condition which could happen and its appearance, if happens, has a harmful influence on the project. The project risk represents a subjective assessment based on the probability of non-realization of the set objective, within framework of the given time, money and other resources. Of course, the project risk represents the probability of realizing any loss during the project life cycle. The negative event of the project can be realized both at the beginning, developmental, finishing phases and in the post finishing phases (maintenance) of the project development. The probability to realize risk can be measured, i.e. supposed on the scale of measurement from zero (impossible) to 1 (sure realization of the negative event). Of course, the extreme values on this scale do not represent any risk because if any negative risk does not happen, it is not a risk. On the other side, risks should not be identified with events or conditions which require intervention or action. Every project of IS development has some specific kinds of risk, however, some categories of risks are usual for all the kinds of projects, no matter how complex their carrying out is. Risks, in general, can be classified into three categories (Heldman, 2003, p. 148): Known risks Known risks with unknown consequences Unknown risks Known risks, with known consequences, are events which the project team knows, and whose probability of appearance is high. Known risks, with unknown consequences, are known to the project team, but their influence on the project is not known if they realize. Unknown risks represent 14

3 Risks in Information Systems Development Projects risks which cannot be identified, therefore there is no way to predict their consequences and make a plan of activities if these events realize. Anyway, it is necessary, even from the general aspect, to include this kind of risk in this plan. Risks can originate from internal and external sources. Internal risks depend on the very project nature, organizational questions, staff, available resources, and so on. External risks include political, legal and other questions. Some of the general risks in IS development projects are: Risk relating to the accordance with project goals between project managers, team members and project purchaser. If the project goals are not clearly defined at the beginning of the project, it is very difficult that the project will attain results. Risk relating to the definition of the project size. Badly defined size can result in the wrong direction of the project development which can cause different consequences as the time limit excess, continual changes of the project size, cost increase, and so on. Risk relating to the project plan definition. This category of risks is similar to the previous category and it can have the same consequences. External risks in IS development projects represent risks which are out of control of the project team and the organization. External risks include risks associated with political, legal and similar questions. Technical problems, if the project is relied on the new technology which is not yet finished, as well as the late appearance of new technology, can represent a potential risk so it is necessary to carry out new alternative solutions if the cited event appears. In addition, the complexity of the project is supposed to be a risk, i.e. if the project team has accepted the project of given size and complexity. If not, it represents risk which can be realized in the form of need for additional time and other resources associated with additional training and advisory services necessary to the team members. Information systems development requiring the use of software tools and program languages unknown to the team members, are also a risk. Experience of the project team also represents one form of risk because practice shows that experiences and older team members can largely reduce the risk of the project failure. Thus, risks in IS development projects are numerous; therefore it is necessary to identify risks relating to the key factors of the project successfulness. Eliminating and mitigating negative influences of risks exerting influence on the key factors of successfulness of IS development improve, to a great extent, the opportunity for the project success. 2. Methodology in risk management projects Risk management includes the set of management methods and techniques used to reduce the possibility of realizing unwanted and harmful events and consequences and to increase the possibility to realize planned results. It is the set of methods enabling to minimize loss, bringing into harmony decreasing probability of loss with the costs this decrease requires (Ćirić, 2004). Risk management represent a continual process including a systematic identification, predicting and evaluating risk factors, as well as planning actions and reactions which can contribute to risk decrease in the project. Risk management starts at the beginning of the project and lasts during the whole project development, even after that. It is possible to identify, at the end of every project phase, risks on the basis of some risk factors. The plan and current risk phase can largely point to some risk factors. Every project of IS development should pass the following phases of the life cycle (Portny, 2007, p. 152): Plan - the initial idea. Defining the beginning plan. Start forming the team. Carrying out work of the project team End end of the project The next table illustrate factors associated with managing IS development projects through the cited phases. 15

4 Ozren Đurković, Lazar Raković Table 2 Possible risk factors (Portny, 2007, p. 152): Phase of of the project life cycle All phases Plan Defining Start Carrying out End Possible risk factors Insufficient time period for one or more phases All information not included Transition to the next phase without finishing one or more previous ohases Unwritten information and plans Badly done cost-benefit analysis Plan carrying out by the team members who have not yet worked in the same or simillar projects Plan not in written form Plan not completely carried out The project team members have not taken part in the plan carrying out Plan is not assessed and verified by the team members participating in its carrying out Absence of procedures for conflic t solving and maintaing high-quality information Changes of clients needs Incomplete or wrong information relating to the schedule of carrying out and necessary resources Absence of reporting on project advancement Leaving of the team members Change of market conditions Changes managment without consistent analysis of consequences which can influence the whole project Project results not formally acknowledged by the project manager New project is assigned to the team members before finishing the current one 3. How to manage risks in projects Risk management in IS development projects represents part of the whole concept of risk management which can largely exert influence on the aggreagate project results. The first step in risk management is to identify possible risks, as well as the evaluation of consequences of risks on the project. Thus, risk management in IS development projects has two key components (Heldman, 2003): Risk evaluation Risk control Every of the cited components include different tasks; the most important are illustrated in Figure 3. Figure 3 Activities of risk management (Jalote, 2002) 3.1. Risk assessment The purpose of risk assessment is risk identification, analisys and prioritization. Risk identification is focused on risk specification associated with the concrete project of information system development. The basic activity in this phase is the attempt to predict all situations which could exert bad influence on the project carrying out. Activities of prioritization take into consideration all the aspects of all risks. Although these are different activities, they often develop simultaneously, i.e. the project manager can identifies and analyzes risks together Risk identification The project risk represents any condition, situation or event which can happen and endanger the project success. Therefore, risk identification represents the projection of all situations and events which can negatively influence the project performance. Methods which can help in determining risks include the check lists of possible risks, reviews, meetings and brainstorming, plan estimates, and so on. To identify risks, managers often use risk lists composed on the basis of previous projects. These lists represent the starting point for risk identification in the current project. It is possible that most risks in the current project appear in the cited list. The project manager can also use the process database to receive information relating to risks and risk management in the similar projects. The assessment and review of previous risks, the managers and team members met earlier, can help in identifying risks relating to the project, but they do not appear in the list. Thus, project managers can use their own opinions and experiences to assess the situations and identify possible risks Risk prioritization The purpose of risk evaluation is risks identification, their analysis and then risk 16

5 Risks in Information Systems Development Projects prioritization. The project risk identification gives possible events which can negatively exert influence on realizing the project goals. However, determining the consequences of risk is a quite different thing. Before we go on with risk management, it is necessary to prioritize projects because all available resources should be focused on the biggest risks. Two factors influence the size of risk: probability of risk realization and consequences which risk has on the project. Thus, the more probable risk represents the natural candidate for risk management. Also, risk with bigger negative consequences on the projects represents the natural candidate for risk management. Risk prioritization requires analyzing possible consequences of risk if risk is realized. One of the ways for risk prioritization is the estimate of probability of risk realization and the consequences if this risk realizes. The product of these values is often called exposition to risk. If Ver(R) represents the probability of risk event realization R, and Gub(R) represents the loss (consequence) if risk realizes, the exposition to risk IR can be obtained according to the following formula: IR = Ver(R) x Gub(R) Based on possible consequences and the probability of risk event, it is possible to calculate the exposition to risk. Thus, this approach requires the quantitative evaluation of risk probability and risk consequences. The historical data associated with risks can facilitate the quantitative evaluation of these parameters. As risks represents events which rarely realize, it is very difficult to collect data relating to them. This fact points that risk prioritization is based more on experience than the past data. As for risk prioritization, i.e. the choice of risks for management, Jalote P. suggests to use the method which includes the following steps: For all risks it is necessary to assess the probability of realizing the risk event as the low, middle and high ones. If it is necessary, the values for the probability of realizing events can be added on the scale from zero to 1. Then, for every risk, it is necessary to evaluate its effect, i.e. consequences on the project as low, middle, high and very high. If it is necessary, the values on the scale from zero to 1 can be added. The next step is risk rating based on the probability and consequences on the project, e.g. risk with high probability and high consequences on the project will certainly have a higher position than the risk with middle probability and high consequences. Of course, if this way cannot rate risks, the project manager s opinion or evaluating of exposition to risk is suggested. The last step represents the choice of several biggest risks which will be managed and followed. Therefore, the major objective of risk management is to identify the biggest risks and then focus on them. The approach to risk prioritization enables to call attention to high risks, but this approach cannot help to carry out costbenefit analyses for risk reduction. Thus, when choosing risk for management, it is necessary to take into consideration the financial effects of risk, i.e. the loss which risk can cause, on the one side, and costs of minimizing the given risk, on the other side Risk control Once, project risks are identifies and prioritized, there is a question what to do with them. Risk knowledge has some value only if we can carry out a plan based on the identified risks to minimize their consequences. Therefore, the basic objective of risk management is to minimize negative risk consequences. Risk control includes risk mitigation planning, observing the plan and supervising risk Risk management planning When risks are identified and prioritized, it is clear which risks should be managed. To manage risks, planning is of great importance. The main task of planning is actions identification which is needed to minimize the consequences of risks. These actions are called the phases of risk mitigating. As with risk identification, to mitigate risks, lists of used phases for mitigating different risks are used. Table 3 illustrates some risks and used steps, i.e. phases for their mitigating. Most risks and phases for their mitigation go without saying. As it can be seen in Table 3, several biggest risks relate to staff and requirements. The phases of risk reduction must be implemented and supervised. To perform all actions for risk mitigation, it is necessary to incorporate them into the schedule of the project execution. 17

6 Ozren Đurković, Lazar Raković Risk monitoring and following Prioritization and planning of risk mitigation are based on risk perception in time when the analysis, i.e. risk identification is done. The starting risk analysis is done during the project planning; therefore the beginning risk management reflects the view on the situation at that time. As risks are possible events, often depending on external factors, risks themselves can change because of changing factors which exert influence on risks. Thus, risks in the project should not be treated as static items but they must be periodically revised. On the contrary, it is possible that some risks cannot be mitigated by actions planned on the basis of data and factors which have been changed. Therefore, it is necessary, besides continual monitoring of progress in risk mitigating, to update periodically risks for the whole project. Table 3 Risks and phases of risk mitigating (Jalote, 2002) Risk category Shortage of technicallly skiled staff Frequent and large change of requirements Unclear requirements Decrease of the team members Unreal schedules Phases of risk reduction Assessment carrying out about the necessaary time of additional training Defining the training program, narrowly connected to the project Carrying out the sessions of training Determining the date for finishing the client s initial requirements Convinction of clients that the change of requirements will influence the schedule of project ececution Defining the procedures for changing requirements Agreeing on details of payments based on the real efforts Use of experience and logic in carrying out supositions relating to requirements Development of the prototype and its estimate by clients Providing resources in all the project fields Organizing th team sessions Job rotation among the team members Filing adequate documentation on the work of every individual Schedule change as agreed with clients Identification of parallel tasks Identification of resources which are temporary available Identification of fields which can be automated Conclusion Risk is an unavoidable factor in IS development projects, therefore it is very important to take it into consideration in carrying out these projects. As many projects do not finish within the framework of set goals or they never finish, risk management should play an important role in managing IS development projects. It is necessary to determine some methodology of risk management in order to identify all the risk in the project. Then, using some methods, based on the probability of realization, influences and costs of risks, it is necessary to determine risks for management. Thus, it is necessary to make a risk management plan which should be implemented in the whole plan of carrying out IS development projects. In addition, it is necessary to supervise carrying out the plan of risk management, as well as periodically identify and exemine again the current and new risks which can negatively exert influence on information systems development. References Bobera, D. (2007). Project Management. Subotica: Faculty of Economics in Subotica. Ćirić, Z. (2004). Management of IS Devlopment Projects, doctoral dissertation. Subotica: Faculty of Economics in Subotica. Heldman, K. (2003). Project Management JumpStart. Alameda: Sybex. Jalote, P. (2002). Software Project Management in Practice. Boston: Addison Wesley. Portny, S. (2007). Project Management for Dummies. Indianapolis: Wiley Publishing, Inc. Risk. (n.d.). Retrieved November 9, 2008, from Wikipedia: (referred on 09/11/2008) Sedlak, O. (2002). Evaluation of risk level and the decision making in conditions of uncertainty, doctoral dissertation. Subotica: Faculty of Economics in Subotica. The Standish group report. (n.d.). Retrieved November 10, 2008, from EDUCASE (Transforming Education Throught Information Technologies): 18

7 Risks in Information Systems Development Projects Ozren Đurković University of Novi Sad, Faculty of Economics Subotica Segedinski put Subotica Serbia Lazar Raković University of Novi Sad, Faculty of Economics Subotica Segedinski put Subotica Serbia